Ransomware Gangs Are Showing Up At Your Door Now. Literally.

Tim Beasley was mid-investigation into a Midnight Blizzard cyberattack when a parcel turned up at his home. Inside: nesting dolls and assorted trinkets from that part of the world. No note. Beasley, then leading Microsoft's Detection and Response Team, had a reasonable guess who sent it.

"We-know-where-you-are kind of stuff," he told The Register. "It's a real eye-opener when you get that type of thing."

Midnight Blizzard, for the uninitiated, is the Russian state-linked group tied to the SVR — the Kremlin's foreign intelligence service. Sending a curated gift basket to the person investigating you is, admittedly, a creative way to say hello.

But what Beasley experienced is increasingly the norm rather than an outlier. Ransomware has evolved from a straightforward encrypt-and-extort operation into something far uglier. Cybercriminals are now routinely using real-world intimidation, psychological pressure, and outright physical threats to squeeze payments out of victims.

Beasley, now a senior incident response consultant at Semperis, has investigated cases where ransomware groups sent C-suite executives photographs of their children's schools. Not as a casual observation. As a message.

"I've seen threats involving people's families, from social media reconnaissance," he said. "In our world you more and more come to expect it, which is unfortunate."

Semperis surveyed 1,200 organisations that had experienced ransomware attacks during the first half of this year. The results are grim reading. Thirty-seven percent reported psychological or physical threats directed at staff. Broken down: 23 percent faced psychological intimidation, 17 percent received physical threats. A quarter were doxxed. Another quarter had employees seek psychological or medical treatment as a direct result of the attack. Nearly as many — 24 percent — ended up hiring personal security.

Swatting featured in 23 percent of cases. That is where attackers phone emergency services with a fabricated emergency — a bomb threat, an active shooter — and send an armed response to a target's address. It is dangerous, occasionally fatal, and apparently now a standard ransomware tactic.

Over half of respondents said attackers followed through on their threats. Among the specific incidents reported: threatening messages, texts, or physical packages (57 percent), threats against family members (37 percent), physical intrusion (19 percent), abduction (17 percent), bodily harm (13 percent), and stalking (6 percent).

This is not fringe behaviour from obscure actors. Beasley names Scattered Spider, ShinyHunters, and Lapsus$ as groups he has personally seen using these tactics.

ShinyHunters, in a somewhat creative piece of PR, told The Register that they "don't attack human beings" — while also acknowledging that "there are times in the work we do sometimes we have to push the corporate to the absolute limit." Draw your own conclusions.

This sits alongside a broader trend flagged by Europol this summer. Operation targeting The Com — a sprawling, loosely organised online network with a notably young membership — identified 4,340 URLs linked to activities including hacking, swatting, digital extortion, and real-world violence. "We've seen violence as a service get used," Beasley said, without apparent exaggeration.

So what should organisations actually do? Beasley's advice is blunt: don't pay. Not once, and certainly not twice.

Semperis found that 69 percent of ransomware victims were hit again within 12 months of their first attack. Thirty-one percent made multiple payments. Paying marks you as compliant, solvent, and worth revisiting.

"Stand your ground," Beasley said. "Don't buckle under the pressure. If you feel like you're under duress, get law enforcement involved. Don't be afraid to call the cops. Don't be afraid to get the FBI involved, sooner rather than later. And don't pay them. Never pay them."

Sensible advice. The industry has been saying it for years. The payment statistics suggest not everyone is listening.